GHSA-qjrq-cvv4-3g9w

Suggest an improvement
Source
https://github.com/advisories/GHSA-qjrq-cvv4-3g9w
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-qjrq-cvv4-3g9w/GHSA-qjrq-cvv4-3g9w.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-qjrq-cvv4-3g9w
Withdrawn
2026-09-25T17:25:51Z
Published
2026-09-08T00:30:22Z
Modified
2026-09-25T17:30:06Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator
Summary
Duplicate Advisory: Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools
Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-9gfj-28hw-jchp. This link is maintained to preserve external references.

Original Advisory

knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool arguments, allowing attackers to read, create, overwrite and delete files outside the project directory. Attackers can supply path arguments containing directory traversal sequences to access arbitrary Markdown files accessible to the server process.

Database specific 
{
    "cwe_ids":  [
        "CWE-22"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-09-25T17:25:51Z",
    "nvd_published_at":  "2026-09-07T23:16:53Z",
    "severity":  "HIGH"
}
References

Affected packages

npm / knowns

Package

Name
knowns
View open source insights on deps.dev
Purl
pkg:npm/knowns

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Database specific

last_known_affected_version_range 
"< 0.30.0"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-qjrq-cvv4-3g9w/GHSA-qjrq-cvv4-3g9w.json"